brennan-payroll-fraud — ghost employee + routing swap cluster
Brennan Corp ghost employee E-88421 paid after termination · ADP/Workday routing change by svc-payroll-admin from 198.51.100.88 · WFM overtime inflation · HCM headcount mismatch. Fully synthetic.
what this proves
- all eight payroll-fraud primary engines produce deterministic, fixture-locked output — verified by
npm run check:flagship(280/280 fleet · 8 for this scenario). - every output is generated 100% locally in your browser — export payroll csvs, never upload HR data.
- ghost employee pay after termination, ADP routing swap by svc-payroll-admin from 198.51.100.88, Workday/HCM mismatches, and WFM overtime inflation surface without sending evidence to a server.
primary engines locked to this fixture
build the case binder
runs all eight primary engines on the synthetic evidence zip and opens a self-contained html binder. uses the default binder renderer for payroll-fraud — no upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic. includes ADP payroll audit csv, Workday payroll export, ghost/adjustment/overtime event exports, HCM headcount, WFM timesheets, and case report manifest json.
built deterministically from scripts/fixtures/build-brennan-payroll-fraud.mjs. seed: brennan-payroll-fraud:v1.
methodology
payroll fraud is rarely one bad paycheck — it is adp audit log → workday export → ghost detector → adjustment detector → overtime inflation → hcm headcount cross-check → wfm timesheet correlation → case report. e-88421 was terminated 2026-01-15 but paid again 2026-04-08; svc-payroll-admin swapped ACH routing from 198.51.100.88. read the full payroll fraud / ghost employee guide →
after the playbook
run each primary locally — or export findings from the binder — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across ghost employee pay, adp routing swap, workday mismatch, overtime inflation, and hcm headcount drift — still zero upload.